Extracted

• • Target

    JaffaCakes118_5cc235bca992542d2a9f412e32cdd196

  • Size

    1.2MB

  • MD5

    5cc235bca992542d2a9f412e32cdd196

  • SHA1

    554595bcc147b930f072508c99bad03d56f596d1

  • SHA256

    dad97f307f734fde769cdd8c471193bb2c7e3c8101e8c6af95e6635cc58d3868

  • SHA512

    8dee4b1fe1c2af90c3fb7b3a2f6944a156b51c36679843ad959b5227b8582c852f57304f6bf2a06c70ea1243a4fc6245ede126b070001b347ba46b703dc9ff57

  • SSDEEP

    12288:QZ47sidAz4J1l+1Ax7olDAvE6wN7pug/6nA99vM6Pphf0y/yrsaMJcR/V0:Q2LdG4J14qx0lPrYA9tM6PphfF4sId0

  Score

  10^/10

  quasarworddiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2